lnk_info

information about Microsoft Windows LNK files

lnk_info shows information about LNK files.

• creation_date: <string> date in ISO8601 format.
• access_date: <string> date in ISO8601 format.
• modification_date: <string> date in ISO8601 format.
• link_flags: <list of strings> basic properties of the LNK file.
• target_path: <string> (optional) target path from Link Target Identifier fields.
• icon_location: <string> (optional) path to the icon location.
• mac_address: <string> (optional) network MAC address.
• mac_vendor_name: <string> (optional) network vendor name from MAC address.
• machine_id: <string> (optional) computer name.
• working_directory: <string> (optional) target working directory.
• relative_path: <string> (optional) target file relative path.
• command_line_arguments: <string> (optional).
• volume_serial_number: <string> (optional) disk volume serial number.
• volume_label: <string> (optional) disk volume label.
• local_path: <string> (optional).
• common_path: <string> (optional).
• network_share_name: <string> (optional).
• extra_data:
  • dlt_properties: <dictionary> dlt properties of the LNK file.
    • birth_droid_file_id: <string>,
    • droid_file_id: <string>,
    • birth_droid_volume_id: <string>,
    • droid_volume_id: <string>
• link_target_id_list: <list of dictionaries> Every entry contains the following fields:
  • clsid: <string>,
  • item_type: <integer>,
  • item_type_str: <string>
• header: <dictionary>.
  • show_window: <integer>,
  • show_window_str: <string>,
  • hot_key: <string>,
  • file_size: <integer>

LNK files

{
  "data": {
        ...
    "attributes" : {
      ...
      "lnkcheck": {
        "creation_date": "<string:ISO8601>", 
        "access_date": "<string:ISO8601>", 
        "modification_date": "<string:ISO8601>", 
        "link_flags": ["<string>",...],
        "target_path": "<string>",
        "icon_location": "<string>",
        "mac_address": "<string>",
        "mac_vendor_name": "<string>",
        "machine_id": "<string>",
        "working_directory": "<string>",
        "relative_path": "<string>",
        "command_line_arguments": "<string>",
        "volume_serial_number": "<string>",
        "volume_label": "<string>", 
        "local_path": "<string>",
        "common_path": "<string>",
        "network_share_name": "<string>"
        "extra_data": {
          "dlt_properties": {
            "birth_droid_file_id": "<string>", 
            "droid_file_id": "<string>", 
            "birth_droid_volume_id": "<string>", 
            "droid_volume_id": "<string>"
          }
        }
        "shell_item": {
          "clsid": "<string>",
          "item_type": "<integer>",
          "item_type_str":"<string>"
        }
        "header": {
          "show_window": "<integer>", 
          "show_window_str": "<string>", 
          "hot_key": "<string>", 
          "file_size": "<integer>"
        },
    }
  }
}

Example

{
  "data": {
    "attributes": {
      "lnkcheck": {
        "common_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "machine_id": "445817", 
        "modification_date": "2016-07-27T18:25:43.570251Z", 
        "link_flags": [
          "HasLinkInfo", 
          "HasRelativePath", 
          "IsUnicode", 
          "HasWorkingDir", 
          "HasExprString", 
          "EnableTargetMetadata"
        ], 
        "vhash": "1234567890", 
        "network_share_name": "\\\\USER\\HTMLQA", 
        "creation_date": "2016-06-28T21:49:46.108805Z", 
        "header": {
          "show_window": 1, 
          "show_window_str": "SW_NORMAL", 
          "hot_key": "(0+0)", 
          "file_size": 6486
        }, 
        "relative_path": "..\\..\\..\\..\\..\\..\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "local_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "working_directory": "C:\\Program Files\\Greenrain\\Submission", 
        "mac_address": "00:50:56:a0:09:e3", 
        "access_date": "2016-06-28T21:49:46.108805Z", 
        "extra_data": {
          "dlt_properties": {
            "birth_droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "birth_droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150", 
            "droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150"
          }
        }, 
        "mac_vendor_name": "VMware, Inc."
      } 
    }
  }
}